yesterday I started reviewing the #fennel downloads we have been publishing on https://fennel-lang.org for the past six years; these have all been signed, so I wrote a quick script to double-check the signatures

what I found was that six of the files did not have their signatures check out, which could be explained by either tampering or manual error

the six files were:

• fennel-1.0.0-arm32
• fennel-1.0.0-windows32.exe
• fennel-1.0.0-x86_64
• fennel-1.3.0-arm32
• fennel-1.3.0-windows32.exe
• fennel-1.3.0.tar.gz

all but the last are binaries, and as such difficult to meaningfully determine the difference between the published version and what I get when I rebuild today

but the tarball only failed verification because the files were in a different order, which makes me lean strongly towards thinking it's due to manual error

however, I will investigate further to eliminate the possibility of foul play

https://lists.sr.ht/~technomancy/fennel/%3C877boaxlkl.fsf@asthra%3E